https://pwn.watch/t/healthcare Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 23 Oct 2026 03:53:49 GMT https://pwn.watch/i/quest-diagnostics-quanum-lsm-breach https://pwn.watch/i/quest-diagnostics-quanum-lsm-breach Fri, 23 Oct 2026 03:53:49 GMT high <p>Quest Diagnostics says it learned on Oct 21 2026 of unauthorized access to its Quanum Lab Services Manager (LSM), the system some clients use to place lab test orders and receive and look up results. Quest believes some patient data in Quanum LSM was accessed and confirms PHI/PII was involved; the specific data affected is still being investigated. Quest paused access to Quanum LSM (and, as a precaution, Essential Insights and LabHQ, where no data was accessed), notified federal law enforcement and engaged outside experts. Core operations are not materially disrupted, and Quest says the incident is not related to the PHP vulnerabilities.</p> <p><strong>Status:</strong> live · <strong>Patch:</strong> partial · <strong>Fixed in:</strong> Access to Quanum LSM paused and the unauthorized access discontinued; full restoration expected as soon as Oct 23</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-22: 8-K filing: Quest believes an unauthorized party accessed certain patient records; federal law enforcement notified and outside experts engaged; operations not materially disrupted. (<a href="https://www.sec.gov/Archives/edgar/data/1022079/000094787126000941/ss6979200_8k.htm">source</a>)</li><li>2026-10-22: Quest FAQ confirms PHI/PII was involved, pauses Essential Insights and LabHQ as a precaution, says the incident is not PHP-related, and expects Quanum LSM back as soon as Oct 23. Clients can use paper requisitions or Quanum eLabs meanwhile. (<a href="https://www.questdiagnostics.com/links/quanum-notice">source</a>)</li><li>2026-10-21: Quest learns of unauthorized access to Quanum LSM, starts incident response and pauses access to the system. (<a href="https://www.sec.gov/Archives/edgar/data/1022079/000094787126000941/ss6979200_8k.htm">source</a>)</li></ul> https://pwn.watch/i/change-healthcare-ransomware-attack https://pwn.watch/i/change-healthcare-ransomware-attack Tue, 22 Oct 2024 00:00:00 GMT critical <p>The ALPHV/BlackCat ransomware gang got into UnitedHealth's Change Healthcare on 2024-02-12 using stolen credentials for a Citrix remote-access portal without multi-factor authentication, then deployed ransomware on 2024-02-21. Claims processing and pharmacy payments across the US health system were disrupted for weeks. By October 2024 Change Healthcare had sent about 100 million notices to individuals (later estimates were about 190 million people).</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2024-10-22: Change Healthcare tells HHS OCR it has sent about 100 million individual notices (<a href="https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html">source</a>)</li><li>2024-05-01: CEO Andrew Witty testifies before the Senate Finance Committee (<a href="https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf">source</a>)</li><li>2024-04-22: UnitedHealth: stolen files could cover a substantial proportion of people in America (<a href="https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html">source</a>)</li></ul>